Thread (285 messages) 285 messages, 6 authors, 2021-11-25
STALE1668d

[PATCH 5.15 074/279] ALSA: gus: fix null pointer dereference on pointer block

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: 2021-11-24 13:49:36
Also in: lkml
Subsystem: sound, the rest · Maintainers: Jaroslav Kysela, Takashi Iwai, Linus Torvalds

From: Chengfeng Ye <redacted>

[ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ]

The pointer block return from snd_gf1_dma_next_block could be
null, so there is a potential null pointer dereference issue.
Fix this by adding a null check before dereference.

Signed-off-by: Chengfeng Ye <redacted>
Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk (local)
Signed-off-by: Takashi Iwai <redacted>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/isa/gus/gus_dma.c | 2 ++
 1 file changed, 2 insertions(+)
diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c
index a1c770d826dda..6d664dd8dde0b 100644
--- a/sound/isa/gus/gus_dma.c
+++ b/sound/isa/gus/gus_dma.c
@@ -126,6 +126,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus)
 	}
 	block = snd_gf1_dma_next_block(gus);
 	spin_unlock(&gus->dma_lock);
+	if (!block)
+		return;
 	snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd);
 	kfree(block);
 #if 0
-- 
2.33.0


Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help